Resurgence Of The Mexals Cryptojacking Campaign
The Mexals crypto jacking campaign has been in operation since at least 2021 and continues to evolve.
A new wave of attacks started in late 2022 with new functionality including SSH worm and LAN spreader modules and improved obfuscation.
The malicious software kills competitor miners and CPU-heavy processes clears command history for defense evasion and creates a cron job for persistence.
Featured Resources
View More Resources
blog
Kerberos Authentication Relay Via CNAME Abuse
Originally published January 15, 2026. Updated January 21, 2026, with new attack scenarios in Cymulate Exposure Validation. Cymulate Research Labs
blog
CVE-2026-20965: Cymulate Research Labs Discovers Token Validation Flaw that Leads to Tenant-Wide RCE in Azure Windows Admin Center
A subtle Azure SSO token validation flaw allowed attackers to escalate privileges and move laterally across WAC-managed systems.
blog
Evolving Vulnerability Management to Continuous Threat Exposure Management
Shift from reactive vulnerability management to continuous, threat-validated exposure management for real risk resilience.